[fix][broker] Fix wrong behaviour when using namespace.allowed_clusters, such as namespace deletion and namespace policies updating

[poorbarcode]

Motivation

Before PIP-321 Introduce allowed-cluster at the namespace level, Pulsar does not support enabling topic level Geo Replication without enabling namespace level Geo Replication, because the policies namespace.replication_clusters has two meanings:

1. Which cluster is allowed to access the namespace?
2. Which clusters enabled Geo Replication?

PIP-321 Introduce allowed-cluster at the namespace level defined a new policy namespace.allowed_clusters, which splits the two definitions.

• if allowed_clusters is not empty
  • allowed_clusters can be used to define which cluster is allowed to access the namespace, if it is set.
• otherwise: the replication_clusters defines both statuses.

---

3 Issues

PIP-321 did not complete all the adaptations of codes, such as follows

• 1. Expected behaviour: when a cluster permission was removed from a namespace, Pulsar will unload the namespace to prevent the topics under the namespace from being loaded up again.
  • Issue: the cluster is still defined allowed by namespace.allowed_clusters, the namespace is also unloaded. More importantly, in this case, all brokers will trigger an unloading, which will cause this namespace to remain unavailable for a long time. Every time any policy of the namespace is updated, unload will be triggered again for a round, which will cause the problem to become so serious as to be uncontrollable. The test testUpdateNamespacePolicies is used to reproduce the issue.
• 2. Expected behaviour: a namespace can only be removed if only one cluster has permission to access it.
  • Issue: the namespace can be deleted even if allowed_cluster is defined as 2 clusters are allowed to access. The test testDeleteNamespaceIfTwoClustersAllowed is used to reproduce the issue.
• 3. Expected behaviour: broker will unload the namespace if the isolation policy is changed, to make the new policy apply.
  • Issue: the namespace will not be unloaded if the allowed permission is defined by namespace.allowed_cluster. The test testUpdateNamespaceIsolationPolicy is used to reproduce the issue.

---

Modifications

• Fix the 3 issues
• Rather than check replication_clusters and allowed_clusters anywhere, use a common method to deal with them, including the following checks
  • Whether a cluster is allowed to access a namaspace.
  • New policy checking.

Documentation

• doc
• doc-required
• doc-not-needed
• doc-complete

Matching PR in forked repository

PR in forked repository: x